from the we're-really-just-like-some-dude-with-a-point-and-shoot dept

Private companies engaging in large-scale surveillance are pushing back against the push back against large-scale surveillance… by filing lawsuits alleging their First Amendment right to photograph license plates is being infringed on by state laws forbidding the use of automatic license plate readers by private companies.

Now, these laws aren't saying law enforcement agencies can't use these readers. They can. What they do say (or did… Utah's law was amended after a lawsuit by license plate reader company Vigilant) is that private companies, like repossession firms and tow truck services, can't use these readers. But apparently they do, and those who manufacture and support the equipment would like to continue capturing this market.

In this case, the two firms in question—Digital Recognition Network (DRN) and Vigilant Systems—generate, maintain, and share access to the license plate reader database with law enforcement.

The new Arkansas state law took effect in 2014, and it bans the private collection of license plate reader data while still allowing the cops to use the devices, usually mounted on patrol cars. The two companies say that their First Amendment rights are being violated, as they are allowed to photograph—even under an automated, high-speed process that is then shared with law enforcement—any and all license plates, anywhere.

There's a bit of a disconnect in Viglant's/DRN's logic, but one that's a bit troublesome for the courts to address. By portraying the capture of license plates at a rate of nearly 1,000 per hour as little more than a digital version of someone taking individual photographs of publicly-displayed plates, the companies hope to make its technology look less intrusive than it is.

The troublesome part is that courts have held that privacy violations that don't exist in the singular can't magically be summoned by en masse collections. There are definitely privacy concerns, however, especially when this information is used (and misused) by law enforcement. But the companies argue that there's nothing personally identifiable about a license plate, at least without access to other databases like those held by states' departments of motor vehicles. (Oddly, law enforcement officials have made the same argument, despite having this access.) This is true, but it's of little comfort when the privately-held database contains 1.8 billion records and is growing at the rate of 70 million per month.

Here's the crux of Vigliant's First Amendment assertions.

Plaintiffs' dissemination of license-plate information collected by ALPR systems is speech protected by the First Amendment. Similarly, the use of ALPR systems to collect and create information by taking a photograph amounts to constitutionally protected speech.

The Act is a content-based speech restriction. The illegality of speech under the statute turns on the content of what is being photographed and transmitted through ALPR systems-license-plate information is covered, but other content is not. The Legislature has singled out the collection and dissemination of "images of license plates" and the resulting "computer-readable data." Ark. Code§ 12-12-1802(2), 12-12-1803(a); see also § 12-121082(3). Moreover, the Act's extensive exceptions further demonstrate that it discriminates based on the content of the speech and the identity of the speaker.

This is a tough hurdle for the state to leap and is likely what prompted Utah to heavily amend its state law in exchange for Vigilant dropping the lawsuit. Unfortunately, in Utah's case, the state seems to have overcompensated. The amendment strikes any prohibition of a private entity collecting license plate data and allows these same entities to sell collected data to other third parties, something it expressly forbids government agencies from doing. It also allows for these companies to hold onto the data for as long as nine months, something that was only 30 days in the original bill.

So, Vigilant's point remains that what it does in terms of collection is not a violation of privacy because it does not have access to DMV databases holding personally-identifiable information. It glosses over the fact that it provides access to hundreds of law enforcement agencies around the US, all of which can acquire the connecting data. But that does seem to put the onus on law enforcement agencies to provide adequate privacy protections, including timely disposal of non-hit data. So far, very few agencies have attempted to so. In Utah's case, there are nine months of historic, non-hit data at law enforcement's fingertips, all with time and location info.

In the singular (as Vigilant's argument goes), this isn't a privacy violation -- no different that someone taking a picture of a vehicle in public. But several months of time and location data creates something that can only be achieved through dedicated surveillance, something that does raise privacy questions, especially in light of the recent court decision finding that law enforcement officers need warrants to track cell phone users' locations. This is the same principle. Law enforcement agencies shouldn't be accessing months of plate location/time data unless it's part of an investigation -- and if it is, someone neutral needs to be deciding whether or not every license plate hit is relevant to the situation.

from the despite-all-these-efforts,-still-rather-reviled dept

Vigilant, one of the nation's largest automatic license plate reader (ALPR) contractors, is trying to keep its public image as untarnished as possible. At this point, Vigilant has nearly 2 billion license plate records stored in its databases, which can be accessed by hundreds of law enforcement agencies.

Very recently, Vigilant took the state of Utah to court for violating its First Amendment right to take pictures and make money (photography/Citizens United, for those trying to keep score) by not allowing it to set up shop within its borders. As that news surfaced, so did a press release from the ALPR contractor which featured glowing comments from law enforcement officers who claimed the database helped track down bad guys (the baddest of the bad, too -- pedophiles) and did nothing more than anyone with a camera could do -- take photos of license plates.

The survey asked seven questions, the first of which was the following: "In your opinion has license plate recognition—the ability for law enforcement to take photographs of license plates with a data and time stamp—helped to solve crimes?"

The results showed that 62 percent of respondents said yes, 10 percent said no, and 29 percent said they were unsure. What conclusion did Vigilant and Zogby draw from this result? It touted that "by a 6-1 margin, Californians say that license plate recognition technology helps police solve crimes."

That bit of exclusionary math notwithstanding (6-4 would be more accurate), it's not clear whether many of the respondents even knew what a license plate reader was or how much data these readers are capable of collecting (up to 60 plates per minute). The respondents may also have been unaware that the plate readers collect far more than photos of license plates. They also collect time/date/location data. So, when those polled responded to the following question, they may not have had any idea how easily the supposedly-innocuous ALPRs can connect a person with a license plate.

The survey also asked: "Do you agree or disagree that license plates reveal nothing about me. People who see my license plate cannot determine my name or where I live."

There's some iffy wording here as well -- the polling company provided no information that shows just how many agencies and entities have access to Vigilant's LPR databases along with access to other driver data from other locations, all of which is linked by license plate numbers. Even without this information, the margin of "victory" for Vigilant is slim: 54% to 46%. But Vigilant has used this flawed poll to claim that Californians support the use of LPRs.

Vigilant Solutions, founded in 2009, claims to have the nation’s largest repository of license-plate images with nearly 2 billion records stored in its National Vehicle Location Service (NVLS). Despite the enormous implications of the database for the public, any law enforcement agency that signs up for the service is sworn to a vow of silence by the company’s terms of service.

Vigilant is clear about the reason for the secrecy: it’s to prevent customers from “cooperating” with media and calling attention to its database.

Vigilant isn't the only manufacturer of law enforcement surveillance/tracking technology to try to keep cops from talking about their shiny new tools. As you'll recall, Harris, manufacturer of the cell tower spoofer called the Stingray, made law enforcement agencies sign the same sort of non-disclosure agreement at the time of sale, one that also prohibited disclosure to not just the media, but to other government agencies as well. This worked out well for law enforcement officers, giving them a reason to skip seeking warrants… right up until all of this was made very public by a court battle.

Here's the actual wording in Vigilant's contract, as uncovered by the EFF:

You shall not create, publish, distribute, or permit any written, electronically transmitted or other form of publicity material that makes reference to LEARN [Law Enforcement Archival and Reporting Network] or this Agreement without first submitting the material to LEARN-NVLS and receiving written consent from LEARN-NVLS. This prohibition is specifically intended to prohibit users from cooperating with any media outlet to bring attention to LEARN or LEARN-NVLS. Breach this provision may result in LEARN-NVLS immediately termination of this Agreement upon notice to you [sic].

Vigilant knows the public would undoubtedly have issues with its multi-billion license plate collection and the fact that several hundred thousand new records are being generated every day. If it had any belief in its product's ability to instill public confidence it wouldn't be suing states, publishing questionable polls and swearing those with inside knowledge to secrecy. Update: After these terms became public, Vigilant has now updated the terms to make them slightly less crazy...

Law enforcement agencies know this as well, but have been willing to let their silence speak volumes. In most cases, technology like that provided by Harris and Vigilant goes into service well before the public even hears about it. Only when it's exposed are any moves made to introduce privacy protections, minimization procedures or anything else that should have been present before the tech hit the streets.

The ultimate hypocrisy of it all is that both Vigilant and law enforcement agencies defend the mass capture of license plate/location data as just gathering publicly-available information. But when it comes to their info, everything's a secret, enforced by contract if necessary. Then they go even further and claim the public information gathered is private and can't be released, even to the owner of the license plates captured. It's a one-way street of data that's disingenuous, dishonest and, above all, an insult to the very public these agencies are meant to serve.